ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| activerecord(RubyGems) | 0 | 2.3.17 | N/A |
| activerecord(RubyGems) | 3.1.0 | 3.1.11 | N/A |
| activerecord(RubyGems) | 3.2.0 | 3.2.12 | N/A |
CVSS Metrics
